Dr. Michael T. Neely is an independent researcher and AI governance and compliance advisor whose work focuses on responsible AI, human oversight, accountability, policy, and the implications of emerging technologies for creative industries and public-interest systems.
Artificial intelligence rarely respects the borders that law uses to allocate authority. A model may be developed in one country, trained on data gathered in several others, deployed through a cloud service headquartered elsewhere, and produce an output that affects a person in a different jurisdiction. The legal problem is therefore not simply whether AI is regulated. It is whether a person harmed by a cross-border AI decision can identify which law applies, which actor is responsible, where a claim can be brought, and what remedy is realistically available.
This problem is becoming more important as AI systems move from generating content to influencing access, opportunity, reputation and rights. A single system can involve a model provider, application developer, deployer, data broker, cloud host and downstream customer. Each participant may be subject to a different legal regime. When responsibility is distributed across that chain, formal compliance by individual actors can coexist with a practical accountability gap for the person affected.
The territorial puzzle
Some legal regimes already reach beyond the physical location of the developer. The EU Artificial Intelligence Act applies in specified circumstances to providers outside the European Union, including where an AI system is placed on the EU market and where output produced by certain third-country providers or deployers is used in the Union. The territorial design reflects an important regulatory reality: location alone cannot determine responsibility for systems whose outputs travel instantly across borders.
Data protection law illustrates the same point. The European Data Protection Board’s guidance on Article 3 GDPR explains how the GDPR’s territorial scope can extend to processing connected to an EU establishment and, in defined circumstances, to offering goods or services to, or monitoring the behaviour of, people in the Union. AI can therefore trigger overlapping questions of data protection, product or platform regulation, consumer law, intellectual property, contract, tort and human rights.
But extraterritorial scope does not by itself solve conflicts of law. A system may be lawful under the rules governing its developer yet create an unlawful or actionable effect where it is deployed. Different jurisdictions may define harm, causation, standing, limitation periods and available remedies differently. Even when more than one state can plausibly regulate the conduct, that does not tell an affected person which forum is accessible or which defendant can actually provide redress.
Responsibility should follow control, not only corporate geography
Cross-border AI disputes expose a weakness in accountability models that search for a single responsible actor. Modern AI supply chains are layered. The model provider may control training and core architecture; the application developer may determine how the model is integrated; the deployer may choose the purpose, affected population and decision workflow; and a customer may determine how an output is acted upon. Responsibility should therefore be allocated according to functions and control rather than reduced to the location of a corporate headquarters.
A useful legal inquiry asks which actor could foresee the relevant risk, which actor had the technical or organisational capacity to prevent it, which actor determined the purpose of deployment, and which actor could correct or reverse the harmful outcome. Those questions do not eliminate established doctrines of jurisdiction or liability. They make them more responsive to distributed systems in which several entities contribute to the same outcome.
This approach also discourages accountability laundering: contractual arrangements in which each participant characterises another entity as responsible for compliance. Contracts can allocate duties between companies, but they should not erase the practical ability of an affected person to identify a responsible entity.
International law is moving toward lifecycle accountability
The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law provides an important international reference point. It is the first legally binding international treaty specifically addressing AI and is structured around activities across the AI lifecycle. Its focus on human rights, democracy and the rule of law is significant because cross-border AI harms cannot be addressed solely as questions of market access or technical safety.
In 2026, the European Union approved the conclusion of the Framework Convention, with implementation in the Union through the AI Act and other relevant EU law. The Convention also calls for risk and impact management and provides a framework for international cooperation. These developments point toward a model in which AI governance is not confined to a single moment of product release; responsibility must be considered throughout design, deployment, use and remediation.
Redress is the missing operational layer
The strongest cross-border AI rules will have limited value if a person cannot challenge an outcome. Effective governance therefore needs a redress architecture as well as substantive standards. At minimum, an affected person should be able to discover that AI materially influenced a consequential process, identify the organisation responsible for that use, obtain an intelligible explanation of the relevant role of the system, contest materially inaccurate inputs or outputs, and reach a human decision-maker with authority to correct the result.
For cross-border systems, these rights should be supported by practical information about jurisdiction and complaint routes. A notice that merely identifies a foreign corporate entity is not meaningful redress. Organisations deploying AI across jurisdictions should designate a clear contact point for affected persons, preserve records sufficient to reconstruct consequential decisions, and maintain escalation procedures that work even when the model provider and deployer are in different countries.
Regulators also need cooperation mechanisms that reduce the burden on individuals. A person should not have to understand a multinational technology stack before a complaint can be investigated. Where several regulators have plausible authority, interoperable complaint referral, evidence-preservation and supervisory cooperation can prevent jurisdictional complexity from becoming a shield against accountability.
A practical cross-border accountability baseline
A workable baseline can be built around five requirements. First, organisations should map the jurisdictions in which a system is developed, offered, deployed and produces legally significant effects. Second, contracts across the AI supply chain should assign concrete duties for documentation, incident reporting, data governance and remediation while preserving rights of affected persons. Third, consequential deployments should maintain traceable records of model versions, material system changes and human interventions. Fourth, users should receive a meaningful route to contest outcomes and seek correction. Fifth, regulators should strengthen mechanisms for cross-border cooperation where the same system affects people in multiple jurisdictions.
These measures do not create a single global AI law. Nor would a single global rule necessarily resolve every conflict. They instead address the operational gap between fragmented legal authority and integrated technological systems. The objective is to make accountability travel with the system rather than disappear at the border.
Conclusion
Cross-border AI makes a basic feature of contemporary governance increasingly visible: technical systems can be global while legal remedies remain territorial. The resulting mismatch creates opportunities for innovation, but also for responsibility to become fragmented among jurisdictions and actors.
The answer is not to abandon territorial law. It is to connect jurisdiction, functional responsibility and redress more deliberately. When an AI system affects a person across borders, the central question should not end with where the model was built. Law and governance should also ask who controlled the relevant risk, where the effect occurred, who could have prevented or corrected the harm, and whether the affected person has a realistic path to challenge the outcome. Cross-border AI governance will be credible only when accountability is as portable as the technology itself.
